Other Articles

Servers – Ensure Access to su Command is Restricted

Support > Fixing Checks > Server

06 March, 2026

This check ensures that access to the su command is restricted to authorized users only.

The su command allows users to switch to another user account, including root. Restricting its usage helps prevent unauthorized privilege escalation and improves system security.

Check Details

  • Resource: Server
  • Check: Ensure access to the su command is restricted
  • Risk: Unrestricted use of su can allow unauthorized users to escalate privileges and gain root access.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Verify that pam_wheel is configured:

    grep pam_wheel.so /etc/pam.d/su

  3. Edit the PAM configuration file:

    sudo nano /etc/pam.d/su

  4. Add or uncomment the following line:

    auth required pam_wheel.so use_uid

  5. Add authorized users to the wheel group by editing:

    sudo nano /etc/group

  6. Update the wheel group entry with authorized users:

    wheel:!:10:root,<user1,user2>
  7. Save the file and exit the editor.

  8. Verify the configuration:

    grep wheel /etc/group
  9. Perform regular audits to ensure only authorized users are allowed to use the su command.